CVE-2026-46323

High

Description

In the Linux kernel, the following vulnerability has been resolved: net: gro: don't merge zcopy skbs skb_gro_receive() can currently copy frags between the source and GRO skb, without checking the zerocopy status, and in particular the SKBFL_MANAGED_FRAG_REFS flag. When SKBFL_MANAGED_FRAG_REFS is set, the skb doesn't hold a reference on the pages in shinfo->frags. Appending those frags to another skb's frags without fixing up the page refcount can lead to UAF. When either the last skb in the GRO chain (the one we would append frags to) or the source skb is zerocopy, don't merge the skbs.

SeverityHigh

CVSS7.8

Exploit probability—

Product

Linux Kernel

PublishedJun 9, 2026

First seenJun 9, 2026

Weakness typeCWE-123CWE-123 CWE-416Use after free

How to fix

Update

linux linux_kernel6.1.176, 6.6.142, 6.12.92, 6.18.34, 7.0.11 or later

Vendor advisories

Affected products

Product	Affected versions	Fixed in
linux linux_kernel	6.0 ≤ v < 6.1.176, 6.2 ≤ v < 6.6.142, 6.7 ≤ v < 6.12.92, 6.13 ≤ v < 6.18.34, 6.19 ≤ v < 7.0.11, 7.1	6.1.176, 6.6.142, 6.12.92, 6.18.34, 7.0.11

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.